System Settings represent user-visible or OS-level configuration settings that influence device behavior, application permissions, connectivity, or system features.
Monitoring system settings changes allows defenders to detect abnormal modifications that may indicate malicious activity or device compromise.
Collection Methods
| Name | Channel |
|---|---|
| android:MDMLog | device USB mode change (charging to file transfer / debugging / accessory) |
| android:MDMLog | Application or service remains active, foregrounds, or overlays during device locked state or immediately at unlock transition with weak recent user interaction context |
| android:MDMLog | No user-initiated airplane mode, radio disablement, or managed network setting change occurred during repeated connectivity degradation |
| iOS:MDMLog | Trusted computer / host relationship established or relevant device trust setting changed |
| iOS:MDMLog | No user-initiated airplane mode or radio-related setting change occurred while applications experience repeated network unavailability |
| MobileEDR:telemetry | Microphone sensor activation or audio recording session initiated by application process |
| MobileEDR:telemetry | Application transitions to background or executes while screen locked during microphone session |
| MobileEDR:telemetry | Cellular service state transitions (in-service→no-service), SIM state change, carrier/operator identifier change, or baseband/telephony stack state change observed by agent telemetry |
| MobileEDR:telemetry | Application remains backgrounded while accessibility service continues to receive events or perform actions across other foreground apps |
| MobileEDR:telemetry | Camera sensor access began from app identity and remained active for sustained capture interval in app context not mapped to approved video recording workflow |
| MobileEDR:telemetry | Camera sensor access occurred while AppState=background, foreground service active without visible user action, or DeviceLockState=locked during capture interval |
| MobileEDR:telemetry | Foreground service continues accessing camera, microphone, location, or other while-in-use sensors after service promotion and outside recent user interaction |
| User Interface | None |